Hi,

On Fri, Jan 18, 2013 at 04:41:00PM -0800, Tejun Heo wrote:
> @@ -125,9 +134,8 @@ static void async_run_entry_fn(struct work_struct *work)
>  
>       /* 2) remove self from the pending queues */
>       spin_lock_irqsave(&async_lock, flags);
> -     list_del(&entry->list);
> -     if (domain->registered && list_empty(&domain->pending))
> -             list_del_init(&domain->node);
> +     list_del_init(&entry->domain_list);
> +     list_del_init(&entry->global_list);

this unconditionally unlinks the global_list entry, however...

>  
>       /* 3) free the entry */
>       kfree(entry);
> @@ -168,10 +176,14 @@ static async_cookie_t __async_schedule(async_func_ptr 
> *ptr, void *data, struct a
>       entry->domain = domain;
>  
>       spin_lock_irqsave(&async_lock, flags);
> +
> +     /* allocate cookie and queue */
>       newcookie = entry->cookie = next_cookie++;
> -     if (domain->registered && list_empty(&domain->pending))
> -             list_add_tail(&domain->node, &async_domains);
> -     list_add_tail(&entry->list, &domain->pending);
> +
> +     list_add_tail(&entry->domain_list, &domain->pending);
> +     if (domain->registered)
> +             list_add_tail(&entry->global_list, &async_global_pending);

if (!domain->registered) then entry->global_list will have NULL pointers
from the kzalloc, so the list_del_init above will crash.

Should it have this?
+       else
+               INIT_LIST_HEAD(&entry->global_list)

Cheers
James
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to